Some scam emails look like they came from inside your own company. They use the same domain and format as the payroll notices.

Microsoft 365 has a feature called Direct Send. It lets printers and apps email staff using the company's address. Microsoft says it "does not require any form of authentication." Scammers can use it too.

Microsoft added a switch to block it in April 2025. It's off by default, so someone has to turn it on.

If you run a company on Microsoft 365, ask your IT person this week whether RejectDirectSend is on. If an internal email asks you to change bank details, call the person on a number you already have.

Source: Microsoft Exchange Team Blog, Apr 28, 2025 (updated May 20, 2026).